CVE-2026-0577 is a medium severity (CVSS 6.3) unrestricted file upload in code-projects Online Product Reservation System 1.0. The /handgunner-administrator/prod.php file mishandles the file upload input, and the exploit is described as public. The record names no fixed version and no vendor advisory, so remove the application from public exposure and fix the code.
What's affected
The record lists code-projects Online Product Reservation System version 1.0 only. The affected file is /handgunner-administrator/prod.php, and the affected input is file upload. It names no fixed version and links no vendor advisory, so do not assume a patch exists.
How to check if you're exposed
This is application code, so check the deployment.
- Confirm whether you run Online Product Reservation System 1.0. The version is usually in the project files or the page footer.
- Search the code for /handgunner-administrator/prod.php and read how file upload is used.
- Review web server logs for requests to /handgunner-administrator/prod.php with unusual values.
- Check whether the application is reachable from the internet.
What to do now
- Find every deployment of Online Product Reservation System 1.0, including test and demo copies.
- Restrict the admin area to trusted addresses, and review who holds admin accounts.
- Change the upload handling in /handgunner-administrator/prod.php: allow only the file types you need, check the content and not only the name, and rename files on save.
- Store uploads outside the web root, or on a path where the server does not execute files.
- Review the upload directory for files you did not add, and check logs for requests to them.
Why it matters
The record tags CWE-284 (improper access control) and CWE-434 (unrestricted upload of a file with a dangerous type). The page accepts an uploaded file without enough checks on what it is or where it goes. A file that the server runs as code can turn an upload into a way to run commands, which is why upload handlers should be strict.
The vector requires a privileged account, which holds the score to 6.3. The record says an exploit has been published. It does not mark the CVE as CISA KEV, and it names no incident.
Quick check
Why does an upload bug matter if it needs an admin login?
Admin accounts can be phished or guessed, and an executable upload gives control of the server. Treat the admin area as a target.
If you want a quick look at your own dependencies, the free in-browser scan at gold.safeguard.sh/scan needs no repository access.
Sources
Referenced by the CVE record (not independently fetched for this guide):
- https://github.com/foeCat/CVE/blob/main/OnlineProductReservation_PHP/file_upload_prod.php.md
- https://code-projects.org/
- https://vuldb.com/?id.339461
Last reviewed: 19 October 2026.
